Attacks on Local Searching Tools
Seth James Nielson, Seth J. Fogarty, Dan S. Wallach

TL;DR
This paper identifies security vulnerabilities in Google Desktop Search that can expose private local data to unauthorized remote attackers through two different attack methods.
Contribution
It reveals specific attack techniques that compromise the privacy of local data accessed via a popular desktop search tool.
Findings
Two attack methods successfully extract private local snippets.
Vulnerabilities allow remote attackers to access sensitive local data.
The attacks exploit the way Google Desktop integrates local snippets with web searches.
Abstract
The Google Desktop Search is an indexing tool, currently in beta testing, designed to allow users fast, intuitive, searching for local files. The principle interface is provided through a local web server which supports an interface similar to Google.com's normal web page. Indexing of local files occurs when the system is idle, and understands a number of common file types. A optional feature is that Google Desktop can integrate a short summary of a local search results with Google.com web searches. This summary includes 30-40 character snippets of local files. We have uncovered a vulnerability that would release private local data to an unauthorized remote entity. Using two different attacks, we expose the small snippets of private local data to a remote third party.
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAdvanced Malware Detection Techniques · Internet Traffic Analysis and Secure E-voting · Security and Verification in Computing
